diff --git a/command/seal.go b/command/seal.go new file mode 100644 index 000000000..1ee7a10b4 --- /dev/null +++ b/command/seal.go @@ -0,0 +1,61 @@ +package command + +import ( + "strings" +) + +// SealCommand is a Command that seals the vault. +type SealCommand struct { + Meta +} + +func (c *SealCommand) Run(args []string) int { + flags := c.Meta.FlagSet("unseal", FlagSetDefault) + flags.Usage = func() { c.Ui.Error(c.Help()) } + if err := flags.Parse(args); err != nil { + return 1 + } + + return 0 +} + +func (c *SealCommand) Synopsis() string { + return "Seals the vault server" +} + +func (c *SealCommand) Help() string { + helpText := ` +Usage: vault seal [options] + + Seal the vault. + + Sealing a vault tells the Vault server to stop responding to any + access operations until it is unsealed again. A sealed vault throws away + its master key to unlock the data, so it physically is blocked from + responding to operations again until the Vault is unsealed again with + the "unseal" command or via the API. + + This command is idempotent, if the vault is already sealed it does nothing. + + If an unseal has started, sealing the vault will reset the unsealing + process. You'll have to re-enter every portion of the master key again. + This is the same as running "vault unseal -reset". + +General Options: + + -address=TODO The address of the Vault server. + + -ca-cert=path Path to a PEM encoded CA cert file to use to + verify the Vault server SSL certificate. + + -ca-path=path Path to a directory of PEM encoded CA cert files + to verify the Vault server SSL certificate. If both + -ca-cert and -ca-path are specified, -ca-path is used. + + -insecure Do not verify TLS certificate. This is highly + not recommended. This is especially not recommended + for unsealing a vault. + +` + return strings.TrimSpace(helpText) +} diff --git a/command/unseal.go b/command/unseal.go index 110e7ae5e..9133f30ea 100644 --- a/command/unseal.go +++ b/command/unseal.go @@ -14,7 +14,9 @@ type UnsealCommand struct { } func (c *UnsealCommand) Run(args []string) int { + var reset bool flags := c.Meta.FlagSet("unseal", FlagSetDefault) + flags.BoolVar(&reset, "reset", false, "") flags.Usage = func() { c.Ui.Error(c.Help()) } if err := flags.Parse(args); err != nil { return 1 @@ -67,6 +69,11 @@ General Options: not recommended. This is especially not recommended for unsealing a vault. +Unseal Options: + + -reset Reset the unsealing process by throwing away + prior keys in process to unseal the vault. + ` return strings.TrimSpace(helpText) } diff --git a/commands.go b/commands.go index 879f98abb..8d0d32151 100644 --- a/commands.go +++ b/commands.go @@ -32,12 +32,14 @@ func init() { "put": func() (cli.Command, error) { return nil, nil }, - - "seal": func() (cli.Command, error) { - return nil, nil - }, */ + "seal": func() (cli.Command, error) { + return &command.SealCommand{ + Meta: meta, + }, nil + }, + "unseal": func() (cli.Command, error) { return &command.UnsealCommand{ Meta: meta,